First Black-Box Adversarial Attack Targets Deep-OCR Systems
A recent study published on arXiv (2608.07636) presents what is purported to be the inaugural pure black-box adversarial attack aimed at a generative OCR vision-language model, specifically Deep-OCR (DeepSeek-OCR). This attack method views the model as an optical compression medium, leveraging its extensive context OCR functions at minimal token costs. The authors reformulate the attack as a zeroth-order optimization challenge, employing a bounded scalar loss based on sequence similarity and estimating gradients through a random-direction finite-difference approach, which ensures that query costs are unaffected by image sizes. The method successfully achieves both untargeted and targeted goals with subtle perturbations using Adam updates with ell_infinity projection. Initial tests on Deep-OCR confirm the effectiveness of this strategy, underscoring potential security risks posed by the complexity of such models and the necessity for enhanced robustness in AI-driven document recognition technologies.
Key facts
- First pure black-box adversarial attack against a generative OCR vision-language model.
- Targets Deep-OCR (DeepSeek-OCR), which treats visual modality as optical compression medium.
- Attack uses zeroth-order optimization with bounded scalar loss on string output.
- Gradient estimation via random-direction finite-difference scheme, query cost independent of image dimension.
- Adam update with ell_infinity projection generates imperceptible perturbations.
- Both untargeted and targeted attack objectives are demonstrated.
- Pilot experiments on Deep-OCR validate the attack method.
- Paper available on arXiv with ID 2608.07636.
Entities
Institutions
- arXiv